Work up VCL-UT: repair CI, reconcile the level ladder, and set direction (#75)

Two parts, as asked: deal with the immediate issues first, then work up
where this goes — theory and VeriSimDB application kept separate.

## Part A — immediate issues (all measured, all verified)

**Two CI faults, independent:**

- `dogfood-gate.yml` was **malformed YAML**. The embedded Python started
at column 1 while the `run: |` block scalar was indented 10, so YAML
closed the scalar early. The workflow had failed **every run in 0s since
at least 2026-07-06** — it never once validated anything — and it broke
Dependabot's `github_actions` updater with
`dependency_file_not_parseable`. Verified by *executing* the extracted
step against valid and invalid manifests, not just by parsing it. (~80
of 266 estate copies carry the identical fault.)
- `dependabot.yml` declared `mix`/`npm`/`pip`/`nix` with no manifests
present — four of the five weekly failures. Also: this repo has **five**
cargo workspace roots and the single `/` entry covered one, so the
parser and `vclt-gate` were invisible to Dependabot.

**Two crates had silently stopped compiling.** `ast::Statement` gained
the consonance field `verb`; `attest` and `recompute-wasm` were never
updated (`E0063`). Only their test modules were stale, so the libraries
still built and nothing complained — **12 tests had just stopped
running**, in the crates carrying the attestation and recompute
boundaries. They were covered by **no CI job at all**, which is exactly
how they rotted. Now fixed and gated.

**Coverage gaps closed:** `e2e.yml` ran 69 of the root workspace's 102
tests — every e2e and fuzz test was skipped. Also removed two `git clone
echidna` steps that cloned a whole repo per run for nothing (proven: 102
tests and `e2e.sh` 19/19 pass with no sibling present).

**Correction to an earlier finding of mine:** I had recorded "0 unit
tests, root `cargo test` is a fake gate". That was **wrong** — an
artefact of truncating the log. The root crate is a re-export facade
whose whole surface lives in `tests/`; the `tests-102 pass` badge was
exact. Noted in the workflow header so the misreading isn't repeated.

**Documentation truth pass** — the level ladder disagreed with the code
three ways:

| | was | now |
|---|---|---|
| Numbering | 1–10 | **L0–L10** (they're wire tags — requesting 7 got
Effect-Tracking, not the Cardinality documented) |
| Vocabulary | `FETCH`/`REMOVE` | `SELECT`/`RETRACT` — the documented
verbs **are rejected by the parser** |
| Count | ten | **eleven** — L10 `EpistemicSafe` appeared in *no
document anywhere* |

## Part B/C — the work-up

`docs/2026-07-21-workup-consonance-and-verisim.adoc`, two strands kept
separate.

**Theory.** The strongest argument for the consonance reframe came from
the code, not from taste: the eleventh level isn't a query-safety
property at all, and it's the one level *not* inherited from TypeLL (a
UI panel has no federation, so no warrant question). The paper is titled
*"A Decalogue…"* — its own title can't house its own eleventh level. The
gap in the world is stated honestly: type-safe query languages are a
**crowded, mature** field and a ten-levels paper reads as synthesis.
What none of them do is type **warrant** — every one assumes a single
source of truth that cannot disagree with itself.

**The whitepaper reframe is a proposal, not an executed rewrite.** The
1,909-line `.tex` is untouched. Structure + a full draft abstract are
offered for approval first — how a paper argues its claim is yours to
settle, and it's the least testable change available here.

**Application.** Opens with the uncomfortable fact: **VCL-UT delivers
nothing to VeriSimDB at runtime today** — the producer is finished and
the consumer was never written (`verisim-api/src/vcl.rs` has zero
`vclt-gate` references). Two VeriSimDB defects located precisely,
including `VCLTypeChecker.res:60` building the default context with
**six** modalities though the type admits eight — Provenance and Spatial
silently absent from every default type-check. Those are VeriSimDB
changes and are **not** made here.

Closes with a falsification section, including one thing that should be
**measured before** the wiring work rather than after: subprocess
latency on the hot path.

## Verification

```
reuse lint                       -> compliant, 460/460
23 workflows                     -> 0 malformed
cargo test --workspace --locked  -> 102 passed
cargo test (parse)               ->  36 passed
cargo test (attest)              ->   9 passed   (was: did not compile)
cargo test (recompute-wasm)      ->   3 passed   (was: did not compile)
bash tests/e2e.sh                -> 19/19, no echidna sibling
                                    150 tests total
```

## Note

The three unpushed `main` commits (sweep2/3/4, Mistral Vibe) are **not**
carried here. They break `reuse lint` — a genuinely fail-closed gate —
by adding an AGPL licence file to a repo with zero AGPL-declared files,
and they inject `@metadatastician` as owner/sponsor into a
`hyperpolymath` repo while duplicating correct `.github/` files.
Recommend `main` be reset to `origin/main` with a `sweep-quarantine`
branch kept for reachability. This branch is based at `origin/main` and
is unaffected.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/dependabot.yml

@@ -1,10 +1,34 @@
 # SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Dependabot configuration for vcl-ut.
+#
+# Trimmed from the RSR template on 2026-07-21. Only ecosystems with an actual
+# manifest in this repository are declared. Declaring an ecosystem with no
+# manifest makes the corresponding Dependabot job fail on EVERY run — this
+# repository was failing `hex`, `pip`, `nix` and `npm_and_yarn` weekly for
+# exactly that reason (measured: 5 consecutive red runs from 2026-07-13).
+#
+# vcl-ut is Rust-only. Verified absent at the root: mix.exs, package.json,
+# requirements.txt, pyproject.toml, flake.nix.
+#
+# Cargo note: this repository has FIVE cargo workspace roots, not one. A single
+# `directory: "/"` entry covers the root workspace only, so the crates holding
+# most of the actual code were invisible to Dependabot. Each self-contained
+# workspace root is now declared explicitly:
+#
+#   /                              root workspace (vcl-ut, fmt, lint, core)
+#   /src/interface/parse           parser + decider + vclt-gate  <- the real spine
+#   /src/interface/attest          depends on ../parse (in-repo)
+#   /src/interface/recompute-wasm  depends on ../parse (in-repo)
+#
+# DELIBERATELY EXCLUDED: /src/interface/echidna-client. It depends on
+# ../../interface, which in turn carries an out-of-tree path dependency
+# (`echidna-core = { path = "../../../echidna/..." }`). Dependabot cannot
+# resolve a path dependency outside the repository, so declaring it would
+# reintroduce exactly the always-red job this trim removes.
 
 version: 2
 updates:
-  # GitHub Actions - always include
+  # GitHub Actions — always include.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
@@ -14,38 +38,33 @@ updates:
         patterns:
           - "*"
 
-  # Rust/Cargo
+  # Rust/Cargo — one entry per self-contained workspace root.
+  #
+  # `open-pull-requests-limit: 0` suppresses routine version-update PRs while
+  # leaving Dependabot SECURITY PRs flowing. The previous `ignore: "*" patch`
+  # rule also silenced security PRs under GitHub's current Dependabot
+  # behaviour. See rsr-template-repo commit 78b050e and
+  # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
       interval: "weekly"
-    # `open-pull-requests-limit: 0` suppresses routine version-update PRs
-    # while leaving Dependabot SECURITY PRs flowing. The previous
-    # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
-    # current Dependabot behaviour. See rsr-template-repo commit 78b050e
-    # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
     open-pull-requests-limit: 0
 
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: "cargo"
+    directory: "/src/interface/parse"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 0
 
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
+  - package-ecosystem: "cargo"
+    directory: "/src/interface/attest"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 0
 
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
+  - package-ecosystem: "cargo"
+    directory: "/src/interface/recompute-wasm"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 0

.github/workflows/dogfood-gate.yml

@@ -280,26 +280,26 @@ jobs:
 
           # Validate TOML structure using Python 3.11+ tomllib
           python3 -c "
-import tomllib, sys
-with open('eclexiaiser.toml', 'rb') as f:
-    data = tomllib.load(f)
-project = data.get('project', {})
-if not project.get('name', '').strip():
-    print('ERROR: project.name is required', file=sys.stderr)
-    sys.exit(1)
-functions = data.get('functions', [])
-if not functions:
-    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
-    sys.exit(1)
-for fn in functions:
-    if not fn.get('name', '').strip():
-        print('ERROR: function name cannot be empty', file=sys.stderr)
-        sys.exit(1)
-    if not fn.get('source', '').strip():
-        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
-        sys.exit(1)
-print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
-" || {
+          import tomllib, sys
+          with open('eclexiaiser.toml', 'rb') as f:
+              data = tomllib.load(f)
+          project = data.get('project', {})
+          if not project.get('name', '').strip():
+              print('ERROR: project.name is required', file=sys.stderr)
+              sys.exit(1)
+          functions = data.get('functions', [])
+          if not functions:
+              print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
+              sys.exit(1)
+          for fn in functions:
+              if not fn.get('name', '').strip():
+                  print('ERROR: function name cannot be empty', file=sys.stderr)
+                  sys.exit(1)
+              if not fn.get('source', '').strip():
+                  print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
+                  sys.exit(1)
+          print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
+          " || {
             echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"
             exit 1
           }

.github/workflows/e2e.yml

@@ -1,4 +1,30 @@
 # SPDX-License-Identifier: MPL-2.0
+#
+# e2e.yml — Root-workspace test gate.
+#
+# The root workspace has four members (vcl-total, vcltotal-fmt, vcltotal-lint,
+# vcltotal-core) and its whole test surface lives in `tests/`, because the root
+# crate is a re-export facade over fmt + lint. Per-crate UNIT counts are
+# therefore all zero, which makes a truncated `cargo test` log look like an
+# empty gate; it is not. Measured 2026-07-21: 102 tests.
+#
+#   tests/e2e_test.rs          20
+#   tests/fuzz_test.rs         13
+#   tests/integration_test.rs  59
+#   tests/property_test.rs     10
+#
+# This job previously ran only property_test + integration_test, so 33 of the
+# 102 — every e2e and fuzz test — never ran in CI. It now runs the whole
+# workspace.
+#
+# The former "Provide echidna sibling" steps have been removed. They cloned a
+# whole repository on every run for nothing: `src/interface` (the member that
+# carries the external `echidna-core` path-dep) is deliberately NOT a root
+# workspace member, so neither `cargo test --workspace` nor `tests/e2e.sh`
+# ever resolves it. Verified 2026-07-21 by running both with no sibling
+# present: 102 tests pass, e2e.sh reports 19/19. echidna-client is gated
+# separately in backend-matrix.yml, which does need the sibling.
+
 name: E2E, Property and Aspect Tests
 on:
   push: { branches: [main] }
@@ -15,27 +41,22 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
       - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
-      # echidna-core path-dependency (src/interface/Cargo.toml) — provide as sibling.
-      - name: Provide echidna sibling
-        run: git clone --depth 1 https://github.com/hyperpolymath/echidna ../echidna
       - name: Run E2E validation
         run: bash tests/e2e.sh
   property:
-    name: Property and integration tests
+    name: Root workspace tests
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install Rust
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
       - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
-      # echidna-core path-dependency (src/interface/Cargo.toml) — provide as sibling.
-      - name: Provide echidna sibling
-        run: git clone --depth 1 https://github.com/hyperpolymath/echidna ../echidna
-      - name: Run property tests
-        run: cargo test --test property_test
-      - name: Run integration tests
-        run: cargo test --test integration_test
+      # Whole workspace, all targets — not a hand-picked subset. Previously
+      # `--test property_test` + `--test integration_test` only, which silently
+      # skipped tests/e2e_test.rs and tests/fuzz_test.rs.
+      - name: Run root workspace tests (expect 102)
+        run: cargo test --workspace --all-targets --locked
   aspect:
     name: Aspect tests
     runs-on: ubuntu-latest

.github/workflows/satellite-crates-gate.yml

@@ -0,0 +1,85 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# satellite-crates-gate.yml — Gates the self-contained satellite workspaces.
+#
+# vcl-ut has FIVE cargo workspace roots, not one. Before this workflow, CI
+# covered only three of them:
+#
+#   /                              e2e.yml
+#   /src/interface/parse           parse-gate.yml
+#   /src/interface/echidna-client  backend-matrix.yml (needs echidna sibling)
+#   /src/interface/attest          NOTHING   <- gated here
+#   /src/interface/recompute-wasm  NOTHING   <- gated here
+#
+# The cost of that gap was measured on 2026-07-21: both ungated crates had
+# stopped compiling. `ast::Statement` gained the S1 consonance field `verb`
+# (DECLARE / ASSERT / RETRACT / MERGE / ...), and neither crate's test module
+# was updated, so both failed with E0063 `missing field 'verb'`. Their
+# libraries still built, so nothing downstream noticed; 12 tests had simply
+# stopped running. Silent rot in exactly the crates that carry the
+# attestation and recompute boundaries.
+#
+# Both crates are self-contained (in-repo path deps only), so unlike
+# echidna-client they need no sibling checkout and can be gated cheaply.
+#
+# Tracked: vcl-ut#25.
+
+name: Satellite Crates Gate
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  satellite-gate:
+    name: ${{ matrix.crate }} — clippy / tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    strategy:
+      fail-fast: false
+      matrix:
+        crate: [attest, recompute-wasm]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # rustup is preinstalled on ubuntu-latest; no third-party action
+      # (avoids the action-pinning / deprecated-cache hazards). Mirrors
+      # parse-gate.yml deliberately.
+      - name: Pin toolchain + components
+        run: |
+          set -euo pipefail
+          rustup show active-toolchain || rustup default stable
+          rustup component add clippy
+          cargo --version && cargo clippy --version
+
+      # Operate via the manifest path so CI never traverses the parent
+      # virtual workspace, whose `src/interface` member carries an external
+      # path-dep that does not resolve in a standalone checkout.
+      #
+      # `--locked` is deliberately NOT used: these two lockfiles drifted while
+      # the crates were ungated. They are regenerated and committed as part of
+      # the repair; once a Dependabot cycle has run against them, `--locked`
+      # should be restored here to make lockfile drift itself a gate.
+      - name: Clippy — warnings are errors
+        run: |
+          set -euo pipefail
+          cargo clippy --manifest-path src/interface/${{ matrix.crate }}/Cargo.toml \
+            --all-targets -- -D warnings
+
+      - name: Tests
+        run: |
+          set -euo pipefail
+          cargo test --manifest-path src/interface/${{ matrix.crate }}/Cargo.toml

Cargo.toml

@@ -5,7 +5,7 @@ version = "0.1.0"
 edition = "2021"
 license = "MPL-2.0"
 authors = ["Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"]
-repository = "https://github.com/hyperpolymath/vql-ut"
+repository = "https://github.com/hyperpolymath/vcl-ut"
 description = "VCL-total: 10-level type-safe query language for VeriSimDB"
 
 # The top-level crate re-exports the formatter and linter for integration testing.